Skip to content

Commit 30f652b

Browse files
ApsTomarneogopher
authored andcommitted
minor changes + fix netlify link
formatted the logging docs
1 parent 3a871a3 commit 30f652b

File tree

1 file changed

+10
-8
lines changed
  • vcluster/learn-how-to/hardening-guide

1 file changed

+10
-8
lines changed

vcluster/learn-how-to/hardening-guide/etcd.mdx

Lines changed: 10 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -18,7 +18,7 @@ the data at rest and in transit via TLS encryption.
1818
appropriately set.
1919

2020
**Audit:**
21-
```kubectl exec -n <vCluster-namespace> <vCluster-pod-name> -- ps -ef | grep etcd```
21+
```kubectl exec -n <vcluster-namespace> <vcluster-pod-name> -- ps -ef | grep etcd```
2222

2323
**Expected Result:**
2424
```
@@ -45,7 +45,7 @@ https://emb-0.emb-headless.emb:2380 --initial-cluster-state=new --force-new-clus
4545
**Remediation:** Run the audit command mentioned below to verify that `--client-cert-auth` is set to `true`.
4646

4747
**Audit:**
48-
```kubectl exec -n <vCluster-namespace> <vCluster-pod-name> -- ps -ef | grep etcd```
48+
```kubectl exec -n <vcluster-namespace> <vcluster-pod-name> -- ps -ef | grep etcd```
4949

5050
**Expected Result:**
5151
```
@@ -72,7 +72,7 @@ https://emb-0.emb-headless.emb:2380 --initial-cluster-state=new --force-new-clus
7272
**Remediation:** Run the audit command mentioned below to verify that `--auto-tls` argument does not exist.
7373

7474
**Audit:**
75-
```kubectl exec -n <vCluster-namespace> <vCluster-pod-name> -- ps -ef | grep etcd```
75+
```kubectl exec -n <vcluster-namespace> <vcluster-pod-name> -- ps -ef | grep etcd```
7676

7777
**Expected Result:**
7878
```
@@ -100,7 +100,7 @@ https://emb-0.emb-headless.emb:2380 --initial-cluster-state=new --force-new-clus
100100
appropriately set .
101101

102102
**Audit:**
103-
```kubectl exec -n <vCluster-namespace> <vCluster-pod-name> -- ps -ef | grep etcd```
103+
```kubectl exec -n <vcluster-namespace> <vcluster-pod-name> -- ps -ef | grep etcd```
104104

105105
**Expected Result:**
106106
```
@@ -127,7 +127,7 @@ https://emb-0.emb-headless.emb:2380 --initial-cluster-state=new --force-new-clus
127127
**Remediation:** Run the audit command mentioned below to verify that `--peer-client-cert-auth` is set to `true`.
128128

129129
**Audit:**
130-
```kubectl exec -n <vCluster-namespace> <vCluster-pod-name> -- ps -ef | grep etcd```
130+
```kubectl exec -n <vcluster-namespace> <vcluster-pod-name> -- ps -ef | grep etcd```
131131

132132
**Expected Result:**
133133
```
@@ -154,7 +154,7 @@ https://emb-0.emb-headless.emb:2380 --initial-cluster-state=new --force-new-clus
154154
**Remediation:** Run the audit command mentioned below to verify that `--peer-auto-tls` argument does not exist.
155155

156156
**Audit:**
157-
```kubectl exec -n <vCluster-namespace> <vCluster-pod-name> -- ps -ef | grep etcd```
157+
```kubectl exec -n <vcluster-namespace> <vcluster-pod-name> -- ps -ef | grep etcd```
158158

159159
**Expected Result:**
160160
```
@@ -174,7 +174,9 @@ https://emb-0.emb-headless.emb:2380 --initial-cluster-state=new --force-new-clus
174174
https://emb-0.emb-headless.emb:2380 --initial-cluster-state=new --force-new-cluster
175175
```
176176

177+
<!-- vale Google.Headings = NO -->
177178
## 2.7 Ensure that a unique Certificate Authority is used for etcd (Manual)
179+
<!-- vale Google.Headings = YES -->
178180

179181
**Result:** PASS
180182

@@ -183,7 +185,7 @@ for api-server is different from the --trusted-ca-file used by etcd.
183185

184186
**Audit:**
185187
Run the following command and note the file referenced by '--trusted-ca-file'
186-
```kubectl exec -n <vCluster-namespace> <vCluster-pod-name> -- ps -ef | grep etcd```
188+
```kubectl exec -n <vcluster-namespace> <vcluster-pod-name> -- ps -ef | grep etcd```
187189

188190
**Returned Value:**
189191
```bash
@@ -199,7 +201,7 @@ https://emb-0.emb-headless.emb:2380 --initial-cluster-state=new --force-new-clus
199201
```
200202

201203
Now run the following command and note the file referenced by '--client-ca-file'
202-
```kubectl exec -n <vCluster-namespace> <vCluster-pod-name> -- ps -ef | grep apiserver```
204+
```kubectl exec -n <vcluster-namespace> <vcluster-pod-name> -- ps -ef | grep apiserver```
203205

204206
**Returned Value:**
205207
```bash

0 commit comments

Comments
 (0)